Data about learning, about teaching and about school operations helps to generate information that can and is being used to benefit students. This, in fact, is one of the key advances powering the dynamic movement to use technology in schools to support student learning. At the same time, not all parents and privacy advocates are equally comfortable with data and its many uses, and justifiably so when it involves personally identifiable information about students. To strike the right balance between the benefits and challenges associated with student data use, the resources of parents, educators, schools and service providers must be marshalled in a shared effort to build expectations that lead to increased trust. In the absence of consensus among all these parties, there remains significant risk that privacy advocacy results in the passage of well-intentioned but regressive policies that slow the adoption of technology in education, erect barriers to promising practices that help atrisk students and impede innovation. The long-term implications for providers, educators and students themselves are serious and profound. Previous work by ExcelinEd examined the legal and regulatory context for student data privacy, particularly on the important roles states play. This paper focuses on the roles and responsibilities of service providers, including education and technology companies, with respect to student data privacy. This paper highlights the reasons why companies should increase their engagement in student data privacy issues, and it suggests high-level tactics and best practices for how to do so. Insights and advice are derived from our research and a series of interviews conducted in early 2016 with leading privacy advocates, service providers and student data privacy experts. While not every best practice identified in this paper is suitable for every company or solution, taken together these practices suggest a positive and productive high-level framework for school providers to build trust among parents and privacy advocates. These best practices for service providers include: (1) Embracing the principles of privacy by design (primarily--though not exclusively--for new product development); (2) Assessing the use cases and need for student data (to re-evaluate and minimize the need for managing personally identifiable information); (3) Providing users with tools to manage data collected about students (including tools that involve parents, as appropriate); (4) Strengthening student data security practices; (5) Reviewing and upgrading privacy policies; (6) Communicating a commitment to the privacy of student data; and (7) Considering support of third-party privacy initiatives, including the Student Privacy Pledge. The paper concludes by offering recommendations for those who are vital to establishing a trusted learning environment, such as investors in education and technology companies, school leaders and philanthropists. Every actor involved in supporting learning and success shares responsibility for establishing appropriate polices, deploying the right tools and maintaining good practices. Coalescing around clear guidelines and expectations for how to make reasonable decisions about student data use will enable the field to find an acceptable balance that advances innovative digital learning opportunities for all students while safeguarding student privacy.